Capability Supply — Curated Tool Sets per Vertical

A vertical agent is only as good as its hands. This brief turns capability acquisition from an ad-hoc admin task into a supply chain: discover, vet, trial, grant, watch. The MCP ecosystem is the catalog; Neutron's job is trust, curation, and lifecycle.

1 · Problem

• Launching a marketing / developer / ops vertical is really a curation exercise: which enrichment, calling, forge, and data tools does the pack ship with, and why are they trusted?
• Today each capability is added by hand: find an MCP server, vet it, configure secrets, grant per agent. Nothing records why it was trusted, nothing watches it after install, and nothing helps an admin (or the admin agent) find the right tool for a goal.
• Supply-chain risk is real: an MCP server is arbitrary third-party code reachable from a governed agent. Trust must be explicit, tiered, and revocable.

2 · The supply chain

flowchart LR
  D[discover
MCP registries · .mcpb bundles
admin-agent proposals] --> V[vet
deterministic analysis +
LLM adversarial pass · shipped]
  V --> T[trial
sandboxed smoke calls
capture tool list + schemas]
  T --> G[grant
trust tier + per-agent grants
per-user OAuth where needed]
  G --> W[watch
pin version · diff on update
re-vet on change · revoke]
  

• Discover. Sources ranked: official MCP registries, vendor-published servers, .mcpb bundle import (manifest-only, shipped), community lists. The admin agent may propose a capability for a stated goal — a gated action like any other agent-admin mutation.
• Vet. The shipped pipeline (deterministic string analysis → clean / caution / elevated / reject, plus an LLM adversarial pass) becomes a recorded verdict attached to the capability row, not a transient check.
• Trial. New: a sandboxed probe that connects, lists tools, and runs declared read-only calls; the captured tool list becomes the baseline for drift detection.
• Grant. Existing per-agent grants and per-user OAuth 2.1; the trust tier sets the default gate posture below.
• Watch. New: version pinning, scheduled re-probe, diff on the tool list (a server that suddenly grows a delete_all tool is a supply-chain event), and one-click revoke that removes every grant.

3 · Trust tiers

Tiers set defaults; the existing tool-policy chain still applies on top, and hard gates remain unwaivable. A tier is data on the capability row — instances can tighten, never silently loosen.

4 · Capability sets

• A named, versioned bundle: capabilities + skills + default policies — e.g. marketing-outreach (enrichment MCP, email, WhatsApp outreach, contacts) or developer (forge MCPs, CI, docs RAG).
• Packs reference sets instead of listing tools inline; installing a pack installs its set, pending owner approval of anything above the floor.
• Sets are the unit of curation Neutron can ship, sell, and update — the product answer to n8n's connector catalog, with trust attached.

5 · Admin-agent flow

sequenceDiagram
  participant U as user
  participant A as admin agent
  participant S as supply chain
  participant O as owner inbox
  U->>A: "set up lead enrichment for the growth team"
  A->>S: search registries · propose capability + set change
  S-->>O: vet verdict + trial report + requested grants
  O->>S: approve (or deny)
  S-->>A: capability granted to growth pack
  A-->>U: workflow ready to wire (PD003)
  

6 · Phases

1. Trust tiers + recorded verdicts (~3–4 sessions). Tier column, vet verdict persisted, tier-driven gate defaults, revoke-all.
2. Trial + watch (~4–6 sessions). Sandboxed probe, tool-list baseline, version pinning, drift alerts to the owner inbox.
3. Sets + discovery (~5–8 sessions). Capability sets, pack integration, registry search connector, admin-agent proposal flow.

7 · Acceptance

• An unvetted capability cannot be granted; a vetted one records verdict, version, and approver.
• A tool-list drift on a pinned server raises an inbox card and downgrades the tier until re-vetted.
• Admin-agent proposals land as owner approvals with the vet report attached — never as silent grants.
• Installing a pack with a capability set grants nothing above the floor without owner approval.